Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

We got a backend server in a specific ISP with a reverse proxy frontend in a different ISP. In order to send mail we use the backend server which connects to a frontend sendmail SMTP server. The problem is that we do not want the backend server to be public for the e-mail receiver, like it currently happens:

Received: from smtp.ourdomain.com (thebackendserver.com [BA.CKE.ND.IP]) (authenticated bits=0) by smtp.ourdomain.com (8.13.8/8.13.8) with ESMTP id oBE2K1NT020323 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 14 Dec 2010 08:20:05 +0100

Any solution for this?

Thanks in advance

share|improve this question

1 Answer

up vote 2 down vote accepted

From RFC 2821, section 4.4:

SMTP servers MUST prepend Received lines to messages; they MUST NOT change the order of existing lines or insert Received lines in any other location.

So I'm not saying it's impossible to do what you want, but do be aware that you'll be violating the RFCs. Undesirable behaviour often results from that.

What do you fear will happen as a result of these (mandatory) lines being added by your interior mail servers?

share|improve this answer
I am not sure if I understood your last question but we do not want the backend server to be public for privacy reasons. We do not want to make easily public where is located our backend. Another solution could be use some proxy or anything like that? Is this a better solution? We run Squid on the SMTP server so maybe we can put Squid on port 25 and the SMTP Server only accesible from localhost in order to access Squid. I do not know if this way will be shown the SMTP server IP instead of the backend server. – Zillo Dec 14 '10 at 13:31
The simplest solution is to send mail directly via the front-end server. I presume, since you haven't listed that, that there's a problem with it; could you say why that wouldn't work for you? – MadHatter Dec 14 '10 at 14:56
We run a vBulletin forum on the backend (that one is the application sending the e-mails), the frontend just run Squid as a reverse proxy. Therefore the application is in the backend and it is also there the database (not in the same machine but it is in the same network). – Zillo Dec 14 '10 at 19:34
OK. What about the backend do you want to conceal? Its existence, or just its identity? If the latter, you could put in a point-to-point VPN (think: openvpn) between app server and mail server, using RFC1918 (private) addresses on the link. There will still be "Received: thebackend.com [10.2.2.2]" but the address will now not give anything away. – MadHatter Dec 15 '10 at 12:30
Just the identity is OK. Can OpenVNC be installed on the frontend like we are currently doing with Squid that runs on port 80 and the web server on a different port? Do you know if using Squid in a similar way would make the same effect? Since it's already installed, running and we have some experience with it.. could be an easy choice, don't you think? – Zillo Dec 15 '10 at 13:03
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.